{"id":"src_ifhg1AYVmbNjpUDvGZ9MZ","slug":"semgrep","name":"Semgrep","type":"github","url":"https://github.com/semgrep/semgrep","orgId":"org_duypVRMu8EI-ooodOs--F","productId":null,"productSlug":null,"org":{"id":"org_duypVRMu8EI-ooodOs--F","slug":"semgrep","name":"Semgrep"},"isPrimary":false,"isHidden":false,"discovery":"curated","metadata":"{\"evaluatedMethod\":\"github\",\"evaluatedAt\":\"2026-04-11T13:59:08.092Z\",\"changelogUrl\":\"https://github.com/semgrep/semgrep/blob/HEAD/CHANGELOG.md\",\"changelogDetectedAt\":\"2026-04-11T14:01:04.703Z\",\"wellKnownSweptAt\":\"2026-06-24T06:00:01.224Z\"}","notice":null,"kind":"tool","stars":15626,"starsFetchedAt":"2026-06-24T23:04:52.279Z","releaseCount":109,"releasesLast30Days":5,"avgReleasesPerWeek":0.9,"latestVersion":"v1.168.0","latestDate":"2026-06-24T19:37:09.000Z","changelogUrl":"https://github.com/semgrep/semgrep/blob/HEAD/CHANGELOG.md","hasChangelogFile":true,"lastFetchedAt":"2026-06-24T23:04:52.279Z","lastPolledAt":"2026-06-24T23:04:47.821Z","trackingSince":"2024-02-09T09:01:57.000Z","releases":[{"id":"rel_DQLWSAlvqW8KxZTym2wQU","version":"v1.168.0","type":"feature","title":"Release v1.168.0","summary":"## [1.168.0](https://github.com/semgrep/semgrep/releases/tag/v1.168.0) - 2026-06-24\n\n### ### Added\n\n- Added an experimental `--x-dependency-paths` fla...","titleGenerated":null,"titleShort":null,"content":"## [1.168.0](https://github.com/semgrep/semgrep/releases/tag/v1.168.0) - 2026-06-24\n\n### ### Added\n\n- Added an experimental `--x-dependency-paths` flag to `scan` and `ci` that includes the full dependency path(s) for transitive supply-chain findings in `--json` and `--sarif` output. (SC-3547)\n\n### ### Changed\n\n- Malicious supply chain rules are now labeled \"Malicious\" instead of \"Basic\" in the scan analysis summary table. (SC-3504)\n\n### ### Infra/Release Changes\n\n- semgrep-core no longer depends on libpcre 8.x; libpcre2 10.x is now the sole regex engine. (drop-libpcre)\n- Aliengrep (generic mode) now uses the maintained libpcre2 10.x regular-expression library instead of the deprecated libpcre 8.x. Matching behavior is unchanged. (aliengrep-pcre2)\n- The `metavariable-regex` and `metavariable-comparison` (`re.match()`) runtimes now use the maintained libpcre2 10.x library instead of the deprecated libpcre 8.x. Matching behavior is unchanged. (eval-generic-pcre2)\n","publishedAt":"2026-06-24T19:37:09.000Z","fetchedAt":"2026-06-24T23:04:49.224Z","url":"https://github.com/semgrep/semgrep/releases/tag/v1.168.0","media":[],"coverageCount":0},{"id":"rel_H5g1jjpQmUchOoTSaAhwh","version":"v1.167.0","type":"feature","title":"Release v1.167.0","summary":"## [1.167.0](https://github.com/semgrep/semgrep/releases/tag/v1.167.0) - 2026-06-17\n\n### ### Added\n\n- Added support for more operators for folding for...","titleGenerated":null,"titleShort":null,"content":"## [1.167.0](https://github.com/semgrep/semgrep/releases/tag/v1.167.0) - 2026-06-17\n\n### ### Added\n\n- Added support for more operators for folding for constant propagation, including subtraction, division, bit ops, bit shifts, comparisons, and more. (const-folding)\n- Added a `nosemgrep_disabled` field to the scan configuration so the platform can disable `nosemgrep` inline ignore comments org-wide for a scan. (APPEX-1122)\n- Semgrep now skips binary files (images, archives, compiled executables,\n  etc.) during scanning by default, detected via matching file extensions\n  to known file-format magic bytes Pass `--no-exclude-binary-files` to\n  scan binary files as before. (ENGINE-2708)\n\n### ### Fixed\n\n- `semgrep ci` with `--sarif` now correctly populates the output's `ignores`\n  field with nosemgrep-suppressed findings, in accordance with other output\n  formatters. (gh-6651)\n\n### ### Infra/Release Changes\n\n- Updated the `ocaml-tree-sitter-core` submodule to the latest upstream `main`, providing\n\n  * improved thread-safety\n  * bumps the tree-sitter CLI option used from 0.20.6 to 0.20.8.\n\n  (ocaml-tree-sitter-core-bump)\n","publishedAt":"2026-06-17T18:21:17.000Z","fetchedAt":"2026-06-17T21:04:06.259Z","url":"https://github.com/semgrep/semgrep/releases/tag/v1.167.0","media":[],"coverageCount":0},{"id":"rel_IB05bOIeQfYl86tUw_aLV","version":"v1.166.0","type":"feature","title":"Release v1.166.0","summary":"## [1.166.0](https://github.com/semgrep/semgrep/releases/tag/v1.166.0) - 2026-06-11\n\n### ### Added\n\n- Pro: Added experimental cross-file (interfile) a...","titleGenerated":null,"titleShort":null,"content":"## [1.166.0](https://github.com/semgrep/semgrep/releases/tag/v1.166.0) - 2026-06-11\n\n### ### Added\n\n- Pro: Added experimental cross-file (interfile) analysis for Gosu, enabling taint tracking across multiple Gosu source files. (gosu-interfile)\n- Added support for more operators for folding for constant propagation, including subtraction, division, bit ops, bit shifts, comparisons, and more (ENGINE-2789)\n\n### ### Fixed\n\n- Fixed parsing of integer literals with an underscore immediately after the radix prefix (e.g. `0x_dead_beef`, `0o_755`, `0b_1010_1010`). (LANG-533)\n- Python parsing now preserves type parameters on `def` and `class` definitions. (LANG-536)\n- Semgrep no longer stores the API token in  `~/.semgrep/settings.yml`'s stored\n  token when the current scan's token is supplied via the `SEMGREP_APP_TOKEN`\n  envvar. (SEC-2240)\n- `semgrep ci` scans originating from a pre-commit hook will no longer fail with\n  `Unable to create '<tmp>/.git/index.lock': Not a directory` in certain cases. (engine-2736)\n\n### ### Infra/Release Changes\n\n- Added parsing tests covering Python language features (Python 3.0–3.12). (LANG-531)\n","publishedAt":"2026-06-11T14:00:10.000Z","fetchedAt":"2026-06-11T15:04:36.909Z","url":"https://github.com/semgrep/semgrep/releases/tag/v1.166.0","media":[],"coverageCount":0},{"id":"rel_MSYjGoYYLVyWFig_nP503","version":"v1.165.0","type":"feature","title":"Release v1.165.0","summary":"## [1.165.0](https://github.com/semgrep/semgrep/releases/tag/v1.165.0) - 2026-06-03\n\n### ### Added\n\n- Added `--max-match-context-size` option to limit...","titleGenerated":null,"titleShort":null,"content":"## [1.165.0](https://github.com/semgrep/semgrep/releases/tag/v1.165.0) - 2026-06-03\n\n### ### Added\n\n- Added `--max-match-context-size` option to limit the number of characters of source code included as context for each match in the output. This prevents matches in minified files (e.g., minified JavaScript where the entire file is a single line) from producing enormous output Set to 0 for unlimited, which is the default value. (ENGINE-2117)\n\n### ### Changed\n\n- Replaced `--x-no-python-schema-validation` with a value-taking `--x-rule-validation=full|core-only|none` flag. The default (`full`) preserves existing Python rule validation behavior; `core-only` matches the old flag's semantics (disables Python rule validation and uses semgrep-core RPC validation only); `none` skips both pre-validation passes, surfacing rule errors at scan-time. `--x-no-python-schema-validation` is still accepted as a no-op with a deprecation warning, and will be removed in a future release. (x-rule-validation)\n- Python: Updated Python grammar (LANG-201)\n\n### ### Fixed\n\n- Added bit shift operations to metavar comparison in addition to already present standard arithmetic operators and logical bit ops. (ENGINE-2448)\n- Reduce intermittent `validation_error` results on HTTP secret validators (Facebook, Slack, Stripe, Google, Cloudflare, etc.) by retrying transient network failures, mirroring the retry behavior already present for AWS validators. (SCRT-965)\n","publishedAt":"2026-06-03T22:02:47.000Z","fetchedAt":"2026-06-03T22:04:46.424Z","url":"https://github.com/semgrep/semgrep/releases/tag/v1.165.0","media":[],"coverageCount":0},{"id":"rel_8NZaLt16ID0nptXrsr7mh","version":"v1.164.0","type":"feature","title":"Release v1.164.0","summary":"## [1.164.0](https://github.com/semgrep/semgrep/releases/tag/v1.164.0) - 2026-05-26\n\n### ### Added\n\n- Dart: typed metavariables (`$X as T`) and `metav...","titleGenerated":null,"titleShort":null,"content":"## [1.164.0](https://github.com/semgrep/semgrep/releases/tag/v1.164.0) - 2026-05-26\n\n### ### Added\n\n- Dart: typed metavariables (`$X as T`) and `metavariable-type`,\n  metavariable binding inside string interpolations, and function-definition\n  patterns that match Dart function definitions. (gh-11678)\n\n### ### Changed\n\n- The default memory limit for Pro interfile scans on Linux now adapts to the container's cgroup memory limit (90% of it) instead of the previous fixed 5 GiB, with an 8 GiB fallback when no cgroup limit is detected. (ENGINE-2568)\n- Lower the glibc contraint from `>=2.35` to `>=2.34`, allowing users on distros\n  that ship glibc 2.34 (e.g RHEL 9 & AL2023) to install the semgrep wheel. (gh-11622)\n\n### ### Fixed\n\n- Baseline diff scans (``semgrep ci`` and ``--baseline-commit``) no longer treat every finding on a file as newly introduced when rule(s) failed during the baseline run.\n\n  Per-rule failures (for example a timeout for a single rule) on baseline analysis now hide only that rule's matches on that file from the \"new vs baseline\" comparison.\n  Other rules on the same file are still taken in comparison for the \"new vs baseline\" comparison.\n\n  Per-file, rule-independent failures now hide all findings on that file from the \"new vs baseline\" comparison. (LANG-515)\n- Fixed a yarn.lock parse error on Yarn Berry entries written\n  in YAML explicit-key form. Affected lockfiles previously failed to parse. (SC-3479)\n- The (beta) SBT resolver with `--allow-local-builds` now correctly identifies dependencies as part of the Maven ecosystem. (SC-3522)\n- Fix `--sarif-output` and `--sarif` causing nosemgrep-suppressed findings to be reported in CLI scan output and to block scans. Suppressed findings are now correctly excluded from terminal text output, the scan-summary count, and the CLI's exit code. (engine-1824)\n- Fixed a bug that could cause unreliable target filtering in parallel scans. (gh-6313)\n- Dart: improved parser fidelity for Dart 3 grammar features and routed\n  pattern parsing for statements beginning with `await`, `rethrow`, and other\n  statement keywords. Eliminates a large class of `PartialParsing` errors on\n  real-world pub.dev packages. (gh-11678)\n\n### ### Infra/Release Changes\n\n- pro: macOS: Fixed dynamic library lookup for `semgrep-core-proprietary` so the binary works when `semgrep install-semgrep-pro` is invoked, and `semgrep` is installed via Homebrew. (pro-binary-homebrew)\n- Pro: Added optional `<case>.named_ast.expect` golden files for `tests/intrafile/maturity/` fixtures, exercised by `Unit_maturity_named_asts`. (LANG-287)\n","publishedAt":"2026-05-27T14:35:42.000Z","fetchedAt":"2026-05-27T15:04:41.379Z","url":"https://github.com/semgrep/semgrep/releases/tag/v1.164.0","media":[],"coverageCount":0},{"id":"rel_i4h4O1clNFhTRu521BHXZ","version":"v1.163.0","type":"feature","title":"Release v1.163.0","summary":"## [1.163.0](https://github.com/semgrep/semgrep/releases/tag/v1.163.0) - 2026-05-13\n\n### ### Added\n\n- Updated PHP target parsing to support grammar ch...","titleGenerated":null,"titleShort":null,"content":"## [1.163.0](https://github.com/semgrep/semgrep/releases/tag/v1.163.0) - 2026-05-13\n\n### ### Added\n\n- Updated PHP target parsing to support grammar changes from PHP 8.1-8.5 (LANG-380)\n\n### ### Changed\n\n- Improved `semgrep ci` startup time with App-provided rules by avoiding duplicate semgrep-core rule validation during CLI rule loading while preserving config-style failures for invalid rules. (ci-rule-validation-startup)\n- Semgrep now validates dependency aware rules only on the core side, improving startup time (validate-skip-dep-aware)\n- Rule validation now runs in parallel across cores on large rulesets, reducing scan startup time. (gh-6279)\n- Rule parsing now runs in parallel across shards on multi-core machines, reducing scan startup time on large rulesets. (gh-6281)\n\n### ### Fixed\n\n- Improved name resolution for fully-qualified names in Java, Kotlin, and Scala. This could lead to fewer false positives and more true positives when the code under analysis uses fully-qualified names instead of imports. (java-qualified)\n- Optimised rule prefiltering and parsing to improve engine startup time. (rule-parse-cache)\n- Reduced peak memory usage when scanning repos with large rulesets. (rules-json-compact)\n- Fixed transitive reachability rule parsing performance: the temporary rule\n  file written for each transitive-reachability RPC call is JSON content\n  (`json.dumps([rule.raw])`) but was being created with a `.yaml` suffix.\n  OCaml's `Parse_rule.parse_file` dispatches purely on file extension, so this\n  routed every TR rule through `Yaml_to_generic.parse_yaml_file` (the slow YAML\n  path) instead of `Fast_json.parse_program` (the new hand-written RFC 8259\n  parser). Switching the suffix to `.json` lines the suffix up with the actual\n  content and lets every TR rule parse take the fast path. (tr-json-suffix)\n- Pro: Fixed a naming resolution bug in Java. (LANG-274)\n","publishedAt":"2026-05-15T16:06:24.000Z","fetchedAt":"2026-05-15T21:00:40.512Z","url":"https://github.com/semgrep/semgrep/releases/tag/v1.163.0","media":[],"coverageCount":0},{"id":"rel_ZqlMLdNRP61z35ul06JMs","version":"v1.162.0","type":"feature","title":"Release v1.162.0","summary":"## [1.162.0](https://github.com/semgrep/semgrep/releases/tag/v1.162.0) - 2026-05-07\n\n### ### Added\n\n- pro: Improved support for tracking taint through...","titleGenerated":null,"titleShort":null,"content":"## [1.162.0](https://github.com/semgrep/semgrep/releases/tag/v1.162.0) - 2026-05-07\n\n### ### Added\n\n- pro: Improved support for tracking taint through nested functions. (LANG-95)\n- Added indexes to file targeting to improve performance of semgrepignore matching. (gh-27830)\n\n### ### Changed\n\n- Faster JSON rule parsing: rule files in JSON format now parse roughly 5x faster end-to-end (measured ~134s → ~28s on a 382MB rule pack) by going through a new hand-written RFC 8259 parser instead of the previous JS-parser-based chain. (ENGINE-2725)\n- Scala projects are now identified for Supply Chain only by their root build.sbt, rather than treating each build.sbt as a different subproject. (SC-3293)\n- MCP `semgrep_findings` tool: added a `refs` parameter to filter findings by branch (defaults to the primary branch when not specified), and made `autotriage_verdict` optional so that findings without an AI verdict can also be returned. (engine-2723)\n\n### ### Fixed\n\n- jsonnet: `import` and `importstr` now reject paths that resolve outside the\n  rule file's parent directory. (ENGINE-2727)\n- semgrep ci: redact URL-embedded credentials and `Authorization` header\n  values from git error messages and from the captured tracebacks sent to\n  the fail-open telemetry endpoint, preventing leaks of secrets like\n  `CI_JOB_TOKEN` from a failed `git fetch` in GitLab CI. Also closes\n  ENGINE-2731 (raw, unsanitized tracebacks in fail-open telemetry). (ENGINE-2728)\n- `semgrep ci` no longer transmits SCM tokens to the Semgrep Platform. (ENGINE-2729)\n- semgrep CLI: the on-disk log file (`~/.semgrep/semgrep.log` or `$SEMGREP_LOG_FILE`) now respects the requested log level instead of always being written at DEBUG. This narrows the surface for credentials to land on disk via CI runner filesystems or job artifacts; pass `--debug` to restore the previous behavior. (ENGINE-2730)\n- jsonnet rules: bound recursion in both rule loading and evaluation so a\n  malicious rule can no longer hang semgrep via mutually-recursive `import`s\n  or runtime function calls that recurse forever. (ENGINE-2727-dos)\n- Scala: Merging consecutive top-level package declarations into a single package path. (LANG-374)\n- Fixed PHP parse errors during highly-parallel parsing. (gh-6197)\n- Fixed Scala parse errors during highly-parallel parsing. (gh-6198)\n- Surface a clearer error from the MCP scan tool when metrics is off and auto config is specified (gh-11649)\n- Fixed unknown option error when spawning the MCP daemon (gh-11660)\n","publishedAt":"2026-05-07T16:03:28.000Z","fetchedAt":"2026-05-07T21:01:12.994Z","url":"https://github.com/semgrep/semgrep/releases/tag/v1.162.0","media":[],"coverageCount":0},{"id":"rel_6aZepnzgGu15iXTY9buI5","version":"v1.161.0","type":"feature","title":"Release v1.161.0","summary":"## [1.161.0](https://github.com/semgrep/semgrep/releases/tag/v1.161.0) - 2026-04-22\n\n### ### Added\n\n- Scala 3.4+ trait parameters are now parsed corre...","titleGenerated":null,"titleShort":null,"content":"## [1.161.0](https://github.com/semgrep/semgrep/releases/tag/v1.161.0) - 2026-04-22\n\n### ### Added\n\n- Scala 3.4+ trait parameters are now parsed correctly. (lang-73)\n\n### ### Fixed\n\n- Semgrep's HTTP requests no longer log URLs above the debug level; full request\n  details remain available when running with `SEMGREP_LOG_SRCS=cohttp.client`. (ENGINE-2712)\n","publishedAt":"2026-04-22T20:28:49.000Z","fetchedAt":"2026-04-23T01:00:55.134Z","url":"https://github.com/semgrep/semgrep/releases/tag/v1.161.0","media":[],"coverageCount":0},{"id":"rel_f6NrnhYy9rvdDE9IDRqqr","version":"v1.160.0","type":"feature","title":"Release v1.160.0","summary":"## [1.160.0](https://github.com/semgrep/semgrep/releases/tag/v1.160.0) - 2026-04-16\n\n### ### Added\n\n- Scala: Added tree-sitter parser for improved par...","titleGenerated":null,"titleShort":null,"content":"## [1.160.0](https://github.com/semgrep/semgrep/releases/tag/v1.160.0) - 2026-04-16\n\n### ### Added\n\n- Scala: Added tree-sitter parser for improved parsing accuracy with pfff fallback. (LANG-255)\n- pro: taint: Improved support for variadic functions (LANG-375)\n\n### ### Fixed\n\n- Fixed performance issues during parsing Semgrep rules containing emoji or\n  other non-BMP Unicode characters. (gh-6070)\n- Emit a warning when semgrep-core rule validation fails and falls back to JSON\n  schema validation, alongside details of the failure. (gh-6071)\n","publishedAt":"2026-04-16T18:11:46.000Z","fetchedAt":"2026-04-16T21:01:39.259Z","url":"https://github.com/semgrep/semgrep/releases/tag/v1.160.0","media":[],"coverageCount":0},{"id":"rel_VRCup1FH9BYYChlzFxyIP","version":"v1.159.0","type":"feature","title":"Release v1.159.0","summary":"## [1.159.0](https://github.com/semgrep/semgrep/releases/tag/v1.159.0) - 2026-04-10\n\n### ### Fixed\n\n- Semgrep now reports an error instead of silently...","titleGenerated":null,"titleShort":null,"content":"## [1.159.0](https://github.com/semgrep/semgrep/releases/tag/v1.159.0) - 2026-04-10\n\n### ### Fixed\n\n- Semgrep now reports an error instead of silently returning zero findings when target file discovery fails (e.g., due to a git ls-files failure). (ENGINE-2626)\n","publishedAt":"2026-04-10T21:00:33.000Z","fetchedAt":"2026-04-11T14:01:04.567Z","url":"https://github.com/semgrep/semgrep/releases/tag/v1.159.0","media":[],"coverageCount":0},{"id":"rel_pDQRXdTC3oO0yxdBigdSL","version":"v1.158.0","type":"feature","title":"Release v1.158.0","summary":"## [1.158.0](https://github.com/semgrep/semgrep/releases/tag/v1.158.0) - 2026-04-09\n\n### ### Added\n\n- Added support for a supply chain hook for the Se...","titleGenerated":null,"titleShort":null,"content":"## [1.158.0](https://github.com/semgrep/semgrep/releases/tag/v1.158.0) - 2026-04-09\n\n### ### Added\n\n- Added support for a supply chain hook for the Semgrep Plugin (supply-chain-hook)\n- Computing taint configs, ~1/4-1/2 of the semgrep-core time in interfile scans, is now done in parallel according to the number of jobs (ENGINE-2649)\n- Semgrep Pro interfile engine (--pro) taint analysis has been redesigned, significantly improving performance (estimated 20-40% improvement). This improvement introduces a slight change in how findings are generated, that may result in more true positives, or less false positives. To revert to previous behavior, pass `--no-x-run-taint-once` as a flag. (engine-2468)\n\n### ### Changed\n\n- semgrep-core macOS binaries are now dynamically linked to the system's libraries. (macos-binary-build)\n- semgrep-core manylinux binaries are now dynamically linked to the system's glibc on glibc systems. This introduces a minimum glibc version requirement of >=2.35, which is satisfied in Ubuntu >=22.04, Debian >=12, RHEL >=10, and other glibc distributions with at least glibc 2.35. Linux systems running an older glibc will need to upgrade their OS. (manylinux-binary-build)\n- The manylinux wheel is now tagged as manylinux_2_35_<arch>, reflecting a minimum\n  requirement of glibc version 2.35. (manylinux-wheel-tag)\n- semgrep-core musllinux binaries are now dynamically linked to the system's musl libc on musl systems. (musllinux-binary-build)\n- The musllinux PyPI wheel is now tagged as musllinux_1_2_<arch>, reflecting a requirement\n  of musl libc version 1.2. (musllinux-wheel-tag)\n- The LSP and MCP servers now use the v2 config download endpoint by default when fetching rules from Semgrep AppSec Platform. Set `SEMGREP_DISABLE_CONFIG_DOWNLOAD_V2=1` to fall back to the legacy endpoint. (SMS-2284)\n\n### ### Fixed\n\n- Fixed IDE login issues where network errors during token verification were incorrectly clearing the saved token. The LSP now distinguishes 401 Unauthorized (invalid token) from other errors (e.g. network failures), surfacing appropriate messages instead. (ide-login)\n- Fixed SARIF taint trace output: step locations now use the correct file URI, and the full taint sink call trace is included in `codeFlows`. (engine-2570)\n- The --x-mem-policy flag now propagates to the RPC subprocess, fixing memory tuning for dependency resolution and other RPC-based operations. (pylon-20772)\n","publishedAt":"2026-04-10T01:46:48.000Z","fetchedAt":"2026-04-11T14:01:04.567Z","url":"https://github.com/semgrep/semgrep/releases/tag/v1.158.0","media":[],"coverageCount":0},{"id":"rel_eTTUrqE7I0QLxyq0x5hpI","version":"v1.157.0","type":"feature","title":"Release v1.157.0","summary":"## [1.157.0](https://github.com/semgrep/semgrep/releases/tag/v1.157.0) - 2026-03-31\n\n### ### Added\n\n- pro: Improved taint tracking through lambda call...","titleGenerated":null,"titleShort":null,"content":"## [1.157.0](https://github.com/semgrep/semgrep/releases/tag/v1.157.0) - 2026-03-31\n\n### ### Added\n\n- pro: Improved taint tracking through lambda calls. (LANG-268)\n- It is now possible to match a class name like in `$C.getInstance(...)`, and then\n  use  `metavariable-type` on `$C` to check its type. (LANG-271)\n- pro: Improve cross-file taint tracking for globals. (LANG-275)\n\n### ### Changed\n\n- Pro: Reduces redundant recomputation during inter-file taint analysis by serializing intermediate results to disk. (ENGINE-2582)\n- pro: Improved golang module resolution. (code-9225)\n- Supply Chain Analysis of npm package lock files now uses a proprietary OCaml-based parser, replacing the old Python version. The supply-chain functionality for these files is now available only to Semgrep Pro users. (gh-5658)\n\n### ### Fixed\n\n- Fix Rust parsing of \"&raw\" where \"raw\" is an identifier. (rust-parser-updated)\n- Errors during target file discovery (e.g., permission errors, git failures) are now surfaced as warnings instead of being silently ignored. (ENGINE-2627)\n- kotlin: Fixed bug parsing FQNs in `metavariable-type`. (LANG-271)\n- Fixed requirements.txt parser silently dropping pinned dependencies that followed unpinned package names. (SC-3379)\n- Prevented certain deeply nested aliengrep matches from segfaulting semgrep-core. (engine-2628)\n- Fix Python parsing for files that contains empty strings (or quotes in docstrings) along with match statements. (gh-11287)\n- Fix rule paths.include/paths.exclude filtering when a single file is passed as a scan target. Previously, path patterns like '**/src/test/**/*.java' would not match because only the filename was used for filtering instead of the full project-relative path. (gh-11560)\n- Pro: Improved type resolution in Scala (lang-79)\n- Pro: Improved call resolution in Scala for parameterless methods (lang-80)\n","publishedAt":"2026-03-31T22:51:26.000Z","fetchedAt":"2026-04-11T14:01:04.567Z","url":"https://github.com/semgrep/semgrep/releases/tag/v1.157.0","media":[],"coverageCount":0},{"id":"rel_nNDXnN8-HmIjhlcQpFCor","version":"v1.156.0","type":"feature","title":"Release v1.156.0","summary":"## [1.156.0](https://github.com/semgrep/semgrep/releases/tag/v1.156.0) - 2026-03-17\n\n### ### Changed\n\n- The Kotlin tree-sitter parser has been updated...","titleGenerated":null,"titleShort":null,"content":"## [1.156.0](https://github.com/semgrep/semgrep/releases/tag/v1.156.0) - 2026-03-17\n\n### ### Changed\n\n- The Kotlin tree-sitter parser has been updated to the latest available grammar significantly improving Kotlin support in Semgrep. (kotlin-parser)\n\n### ### Fixed\n\n- Pro: Experimental interfile tainting for Ruby now disambiguates between variable accesses and zero-argument method calls. (engine-2556)\n- Pro: Memoize tsconfig.json parsing to avoid redundant re-parsing across a project hierarchy. (engine-2596)\n- Fixed a crash in `semgrep ci` when run in a git repo with no remote origin set (gh-11342)\n","publishedAt":"2026-03-17T21:18:25.000Z","fetchedAt":"2026-04-11T14:01:04.567Z","url":"https://github.com/semgrep/semgrep/releases/tag/v1.156.0","media":[],"coverageCount":0},{"id":"rel_wNmvvBCjOKd3dYZn8bZJE","version":"v1.155.0","type":"feature","title":"Release v1.155.0","summary":"## [1.155.0](https://github.com/semgrep/semgrep/releases/tag/v1.155.0) - 2026-03-11\n\n### ### Added\n\n- Added support for (agentic) hooks in Windsurf. (...","titleGenerated":null,"titleShort":null,"content":"## [1.155.0](https://github.com/semgrep/semgrep/releases/tag/v1.155.0) - 2026-03-11\n\n### ### Added\n\n- Added support for (agentic) hooks in Windsurf. (windsurf-hooks)\n- scala: Improved support for Scala 3's optional braces. (LANG-218)\n- Added PowerShell language support (beta) with parsing and pattern matching (lang-233)\n\n### ### Changed\n\n- Removed the experimental and undocumented command `semgrep install-ci`. (osemgrep-install-ci)\n- Migrate from publishing a single Linux wheel with the platform tag `musllinux_1_0_<arch>.manylinux2014_<arch>` to publishing two separate wheels:\n\n  - A wheel with the platform tag musllinux_1_0_<arch>\n  - A wheel with the platform tag manylinux2014_<arch>\n\n  (pypi-linux-tag)\n\n### ### Fixed\n\n- When performing parallel operations over a small number of input items, the\n  engine no longer spawns more OCaml domains than we have items to process.  This\n  assists with resource utilisation. (engine-2588)\n- Fixed: Prevent SessionStart hook crash when inject-secure-defaults receives empty stdin (JSONDecodeError). (engine-2592)\n- Semgrep secret validation now times out after 30 seconds instead of 15 minutes. Additionally this timeout is configurable via the `--secrets-timeout` flag. (engine-2593)\n- Fixed permission errors during lockfileless Java (Gradle) dependency resolution by invoking gradlew via sh when the executable bit is not set (gh-5747)\n","publishedAt":"2026-03-11T20:54:32.000Z","fetchedAt":"2026-04-11T14:01:04.567Z","url":"https://github.com/semgrep/semgrep/releases/tag/v1.155.0","media":[],"coverageCount":0},{"id":"rel_xEtq-CQHnfSzKBxloKN7H","version":"v1.154.0","type":"feature","title":"Release v1.154.0","summary":"## [1.154.0](https://github.com/semgrep/semgrep/releases/tag/v1.154.0) - 2026-03-04\n\n### ### Fixed\n\n- Fix crash on Windows when running `semgrep ci` w...","titleGenerated":null,"titleShort":null,"content":"## [1.154.0](https://github.com/semgrep/semgrep/releases/tag/v1.154.0) - 2026-03-04\n\n### ### Fixed\n\n- Fix crash on Windows when running `semgrep ci` with `--debug` and no blocking findings. The Windows subprocess path incorrectly raised an exception for all pysemgrep exit codes (including 0), which was silently swallowed in normal mode but propagated as a fatal error when `--debug` was active. (ENGINE-2491)\n- Changed default memory policy from \"eager\" to \"balanced\".  Scan times should\n  noticably improve; however, scans may use 5-10% additional memory.  If running\n  in a resource-constrained environment, consider setting the memory policy back\n  to \"aggressive\". (engine-2055)\n- When Semgrep decides which files to scan (targeting), it can take a long time (over 5 minutes) on very large repos (> 10k files). Semgrep will now parallelize this work according to the number of jobs passed (`-j`) (engine-2512)\n- Fixed a performance issues where passing many scannign roots on the command\n  line (e.g. `semgrep scan $(git ls-files '*.py')`) caused one semgrep-core\n  subprocess to be spawned per file. Roots that are not directories are now\n  handled directly in Python without any subprocess overhead. (gh-11404)\n- Scala: Restored parse rate after mistaken bug introduced by implicit block parsing fix (lang-215)\n","publishedAt":"2026-03-04T20:05:29.000Z","fetchedAt":"2026-04-11T14:01:04.633Z","url":"https://github.com/semgrep/semgrep/releases/tag/v1.154.0","media":[],"coverageCount":0},{"id":"rel_ARTKOWJn7G-MD0ePn3Bhf","version":"v1.153.0","type":"feature","title":"Release v1.153.0","summary":"## [1.153.0](https://github.com/semgrep/semgrep/releases/tag/v1.153.0) - 2026-02-25\n\n### ### Added\n\n- Semgrep core is now optimized with flambda (flam...","titleGenerated":null,"titleShort":null,"content":"## [1.153.0](https://github.com/semgrep/semgrep/releases/tag/v1.153.0) - 2026-02-25\n\n### ### Added\n\n- Semgrep core is now optimized with flambda (flambda)\n- Scala: Support for `for`-`yield` (LANG-193)\n\n### ### Fixed\n\n- Scala: Fixed a parsing bug where subsequent calls in an implicit block would not\n  be considered at the same scope, e.g.\n  ```\n  def f (a: t) =\n    foo()\n    bar()\n  ``` (lang-194)\n","publishedAt":"2026-02-25T23:56:00.000Z","fetchedAt":"2026-04-11T14:01:04.633Z","url":"https://github.com/semgrep/semgrep/releases/tag/v1.153.0","media":[],"coverageCount":0},{"id":"rel_iiBP7AZllz02uN7AxKJ_c","version":"v1.152.0","type":"feature","title":"Release v1.152.0","summary":"## [1.152.0](https://github.com/semgrep/semgrep/releases/tag/v1.152.0) - 2026-02-17\n\n### ### Added\n\n- Hooks (for both Claude Code and Cursor) now pull...","titleGenerated":null,"titleShort":null,"content":"## [1.152.0](https://github.com/semgrep/semgrep/releases/tag/v1.152.0) - 2026-02-17\n\n### ### Added\n\n- Hooks (for both Claude Code and Cursor) now pull custom rules from the registry (custom-rules-hooks)\n- Turned on DNS rebinding protection for the MCP server (dns-check)\n- Environment variables can now be passed to third-party package managers invoked as part of `--allow-local-builds` dependency resolution via the environment variable `SEMGREP_LOCAL_BUILD_ENV`, which accepts a JSON object with string keys and string values. (SC-3163)\n- Memory management policies\n\n  A memory policy defines how OCaml's garbage collector should be configured for\n  a scan.  There are two initial policies: \"aggressive\", the current behaviour,\n  which trades longer scan times for lower memory use, and \"balanced\", which\n  finds a middle ground between reclaiming heap memory in short order while\n  limiting how often the garbage collector runs.  The policy can be configured\n  via the `--x-mem-policy` CLI flag for the pro engine; this flag is unused in\n  the OSS engine. (engine-2055)\n- Added experimental support for the OpenFGA authorization language. Thanks to Alex Useche (@hex0punk) for the contribution! (gh-11347)\n- Allows case insensitive string comparisons using lower() and upper() like this:\n\n  ```\n  - metavariable-comparison:\n      metavariable: $VALUE\n      comparison: upper(str($VALUE)) == \"SEMGREP\"\n  ```\n\n  (gh-11502)\n- Blocking findings that are outputted in the CI output are now labelled as such. (#4394)\n\n### ### Changed\n\n- pro: There should be fewer FNs when the max number of fields to track per object\n  is reached. (code-9224)\n- Remove legacy combined symbol analysis computation and upload in favor of per-subproject symbol analysis (sc-3153)\n\n### ### Fixed\n\n- pro: Improved accuracy of taint tracking through assignments, this will help\n  reduce FPs in some cases. (code-9220)\n- When receiving a 429 or 5xx from the Semgrep app, the CLI will wait for a\n  longer period of time before retrying the request, to spread out requests\n  during periods of app instability. (engine-2550)\n","publishedAt":"2026-02-18T00:43:14.000Z","fetchedAt":"2026-04-11T14:01:04.633Z","url":"https://github.com/semgrep/semgrep/releases/tag/v1.152.0","media":[],"coverageCount":0},{"id":"rel_mSHvq0UZvxh6sk9nVJRM5","version":"v1.151.0","type":"feature","title":"Release v1.151.0","summary":"## [1.151.0](https://github.com/semgrep/semgrep/releases/tag/v1.151.0) - 2026-02-04\n\n\n### Added\n\n\n- Added progress indicators for symbol analysis calc...","titleGenerated":null,"titleShort":null,"content":"## [1.151.0](https://github.com/semgrep/semgrep/releases/tag/v1.151.0) - 2026-02-04\n\n\n### Added\n\n\n- Added progress indicators for symbol analysis calculation and upload during CI scans (sc-3103)\n\n\n### Fixed\n\n\n- bumped `glom` to at least version `23.3`, which includes a fix to a `SyntaxWarning`\n  warning log. (gh-11460)\n- Semgrep no longer prints info log lines from semgrep-core RPC calls when --trace is passed and --debug isn't (loglines)\n- Fixed the README not appearing in built wheels. (wheelreadme)\n","publishedAt":"2026-02-04T18:36:56.000Z","fetchedAt":"2026-04-11T14:01:04.633Z","url":"https://github.com/semgrep/semgrep/releases/tag/v1.151.0","media":[],"coverageCount":0},{"id":"rel_ri9neWuHnGKOqRJSLglVf","version":"v1.150.0","type":"feature","title":"Release v1.150.0","summary":"## [1.150.0](https://github.com/semgrep/semgrep/releases/tag/v1.150.0) - 2026-01-29\n\n\n### Added\n\n\n- Connecting to the Semgrep MCP server via streamabl...","titleGenerated":null,"titleShort":null,"content":"## [1.150.0](https://github.com/semgrep/semgrep/releases/tag/v1.150.0) - 2026-01-29\n\n\n### Added\n\n\n- Connecting to the Semgrep MCP server via streamableHttp now requires OAuth. (saf-2453)\n\n\n### Changed\n\n\n- Migrated from `pipenv` to `uv` for `./cli` package management (uv)\n\n\n### Fixed\n\n\n- pro: Improved virtual method resolution in Scala (code-9213)\n- Improved performance for supply chain scans by reducing pre-computation when printing the scan status. This results in slightly less information being displayed in the case that there are no rules to run. (gh-5436)\n- Supply Chain Analysis: fixed version range matching for NPM packages with versions containing a prerelease identifier such as `-alpha` in `1.2.3-alpha`. (sc-3001)\n","publishedAt":"2026-01-29T22:50:07.000Z","fetchedAt":"2026-04-11T14:01:04.633Z","url":"https://github.com/semgrep/semgrep/releases/tag/v1.150.0","media":[],"coverageCount":0},{"id":"rel_ylb59YTiNN0YutztBbi7C","version":"v1.149.0","type":"feature","title":"Release v1.149.0","summary":"## [1.149.0](https://github.com/semgrep/semgrep/releases/tag/v1.149.0) - 2026-01-21\n\n\n### Added\n\n\n- Added a warning in --debug mode when a user runs a...","titleGenerated":null,"titleShort":null,"content":"## [1.149.0](https://github.com/semgrep/semgrep/releases/tag/v1.149.0) - 2026-01-21\n\n\n### Added\n\n\n- Added a warning in --debug mode when a user runs a parallel scan with a larger\n  value for -j/--jobs than the number of CPUs we detect the host has made\n  available to Semgrep.  Additionally, a suggested starting value for -j/--jobs\n  is reported to give the user a place to start tuning their scan. (saf-2474)\n- Upload symbol analysis on a per-subproject basis during supply chain scans. (sc-3038)\n\n\n### Changed\n\n\n- The MCP server no longer supports SSE transport. (saf-2462)\n\n\n### Fixed\n\n\n- pro: Improved virtual method resolution in Java (code-9210)\n- pro: Improved virtual method resolution in Scala (code-9212)\n- Improve performance of scan planning, a part of the Python CLI, by reducing\n  the cost of re-hashing `Target` objects.  Performance should improve on\n  large repo scans proportionally to the number of files in the repo. (gh-5407)\n- `semgrep ci` no longer applies autofixes to disk, even when the \"Suggest autofixes\" toggle in the app is enabled. (saf-2446)\n","publishedAt":"2026-01-21T20:21:37.000Z","fetchedAt":"2026-04-11T14:01:04.633Z","url":"https://github.com/semgrep/semgrep/releases/tag/v1.149.0","media":[],"coverageCount":0}],"pagination":{"nextCursor":"2026-01-21T20:21:37.000Z|2026-04-11T14:01:04.633Z|rel_ylb59YTiNN0YutztBbi7C","limit":20},"summaries":{"rolling":{"windowDays":90,"summary":"Semgrep shipped a string of performance improvements and pro-tier enhancements across the interfile analysis stack. The team redesigned pro taint analysis with an estimated 20-40% performance lift, parallelized taint config computation and file targeting to scale with job count, and adjusted the memory policy default from \"eager\" to \"balanced\" to reduce scan times at the cost of slightly higher memory use. Language support expanded with PowerShell (beta), improved Kotlin parsing, and better Scala 3 optional braces handling, while cross-file tracking grew smarter for taint through lambda calls, globals, and virtual method resolution in Java and Scala. The supply chain subsystem migrated its npm lock file parser from Python to a proprietary OCaml version and now uploads symbol analysis per-subproject.","releaseCount":12,"generatedAt":"2026-04-11T14:01:08.677Z"},"monthly":[{"year":2026,"month":3,"summary":"March expanded pattern matching capabilities and language support while optimizing the analysis engine. Taint tracking through lambda calls and cross-file globals improved for Pro users, class name matching with `metavariable-type` graduated to general availability, and PowerShell entered beta with full parsing and pattern matching support. Performance work included parallelized file targeting for large repositories and a memory policy shift to \"balanced\" that trades modest memory overhead for notably faster scans.","releaseCount":4,"generatedAt":"2026-04-11T14:01:10.850Z"}]}}